Enforce org-scope on swarm reads and escape nodeId
fix(security): enforce org-scope on swarm reads and escape nodeId
Enforce org-scope on swarm reads and escape nodeId556369-fix-enforce-org-scope-on-swarm-reads-and-cve-2026-72876fixenforce org scope swarm reads escape
Committed by Siumauricio
commit message
fix(security): enforce org-scope on swarm reads and escape nodeId
swarm.getNodes/getNodeInfo/getNodeApps/getAppInfos accepted a caller-supplied
serverId and ran remote Docker Swarm reads against it with no organization
check, exposing another tenant's swarm topology cross-org (getContainerStats
already had the check; the others did not). getNodeInfo additionally
interpolated nodeId unescaped into 'docker node inspect ${nodeId}'.
Adds an org-ownership assertion to the four unscoped handlers and passes nodeId
through shell-quote in getNodeInfo.
Closes GHSA-jj6h-388v-9rwmEditor assessment
This commit patches CVE-2026-72876. The subject combines a missing authorization check with escaping work, and the body separates them clearly. It explains that getNodes, getNodeInfo, getNodeApps and getAppInfos accepted a caller-supplied serverId and ran remote swarm reads without an organization check, exposing another tenant's topology, while getContainerStats already had the guard. It also notes nodeId was interpolated raw into docker node inspect. The remediation, an org-ownership assertion on four handlers plus shell-quote on nodeId, matches the diagnosis. Precise and readable, though nothing documents how the cross-org access was verified.